From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A127C25B78 for ; Tue, 28 May 2024 08:40:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id F05796B0089; Tue, 28 May 2024 04:40:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E8E376B008A; Tue, 28 May 2024 04:40:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D2ED06B008C; Tue, 28 May 2024 04:40:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id B1F9B6B0089 for ; Tue, 28 May 2024 04:40:12 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 6E7C21A010E for ; Tue, 28 May 2024 08:40:12 +0000 (UTC) X-FDA: 82167157464.09.14CE162 Received: from mail-vk1-f175.google.com (mail-vk1-f175.google.com [209.85.221.175]) by imf03.hostedemail.com (Postfix) with ESMTP id A6C9620013 for ; Tue, 28 May 2024 08:40:09 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=fxxuTkKU; spf=pass (imf03.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.175 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1716885609; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=EWuC8xgrTpZG5Uvy93xdyyoFAubSFjnfdPMHtKysMIs=; b=C2G9ZVHfSaGUZgsiKW+orrnk0ldsjr2jYy30br5Fo/l+wDhiOHxw2vhMHRFVTXrSdkgj6A Xu7vliwxzV3TFixL4+5Un6sT/nrD0WlwGlC6ICYkG7Lvn1CToNG64SN0bQXXZa4W1jCEBX 9dqqHN/yOfcJxZKD0k1Mgmp/9p4ZQp4= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1716885609; a=rsa-sha256; cv=none; b=mfi/HEE8NSXD1bIiQksjvXlvpIGwjaaB5KILeTV1/rBoPe/20OcoS8MyRq5ETLn9yNRcyP 4JxVbibFsl++OPn6MgWp0f9pzHpiqelqP58p9QcnuaRRxR3KsHhPJIiwQ/skklyZxhbp4g hk6Db5Ffz5Y4qbUj8jUbXkXH/FnHldQ= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=fxxuTkKU; spf=pass (imf03.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.175 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-vk1-f175.google.com with SMTP id 71dfb90a1353d-4e4f004bd17so180894e0c.3 for ; Tue, 28 May 2024 01:40:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1716885608; x=1717490408; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=EWuC8xgrTpZG5Uvy93xdyyoFAubSFjnfdPMHtKysMIs=; b=fxxuTkKUhn75WAv+9TN6214QoTXY2SHmM3wFpCPdd1IR3TXN3jtQwY832CrGFMWZC5 3jZDqc6TuCyYk678bswuAsx+4mg1igpFafI01TcaG2pVHDjmH2pp4BfGSnyftNU2/gFR /UugOS9f6quqCXnGcSlIzlXfQQU+Mq9pFBDz+MdeVj0uZxVn9LV6WMSKVWebSAwkzkqF SAgM9sOPomqBKKdpvr28dUArPtjyG7FH0L6VFGqs3QShRJzolzc9FkTM5iyDJ6omgnLJ 7PewVwDgiEG9bb8TQh3IDCxVMJkMuL8P3M/lZkN7l93udXrF1r79adELN1iufCWaK6K4 mRSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716885608; x=1717490408; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EWuC8xgrTpZG5Uvy93xdyyoFAubSFjnfdPMHtKysMIs=; b=VgbyaCXLlwKO9lInwO35T7y8qK08s2CIslZrVIrmNtobNzvIUPYnXE9ZP1htn/xnZa lBoyM4cq0v5cj5UIA7YIfGHYPoSmqFZfkfUrD6JvYBB5KDRNa0SA1NUdIqzsUM6jfs3X 8K3vSHJL9p53se+jpukvgFvjd6R9yS4QWRZ3mN1xyWp1W48t+1nsEHLDcl0Bt3viPpSD lx26dA+zSHnic1xKHReB/sRQSD9MwsDcY3NKX+7bDyM/0EGuJQ1cfdhuehK/2hpTqgJA oQTXsFC+8mrNSOpLv5WswX878XOo6oFqqtjAtCxpyzf8BwOwZdRyQlLtLRc3ap/wdut4 WhkQ== X-Forwarded-Encrypted: i=1; AJvYcCVSaUcHP1FXmsM5ImLtRkxR9KFaa074UamSHU7f2EMMWZNmKv2BIkaFfS0vuGX+uM9KPKYPWOGWm7SIr/55hNlvo7U= X-Gm-Message-State: AOJu0YxGAPN6MpOlTXGO2lQM6r/mZf51l58CHMHYDuG3GG0fo1w+G3df HE1uGmd2VDVzLd/Da6D3R+T4yYN7lVFoRg+ZQgYcnsDD3xqw5I1b6hL/H/++nYCGIccPDvqu9MF wzQ1REo9fZj3LMI/OauomFswpqAQ= X-Google-Smtp-Source: AGHT+IF13MovFPCZamxq7SoRZIg8j15/Ti552guT68JxrpbWpf9K2PO2JhDh2O1HCO44j9AT+vZ4cf686VUPP4sPj9A= X-Received: by 2002:a67:ec50:0:b0:47c:11ba:fea9 with SMTP id ada2fe7eead31-48a3866f8famr10912129137.23.1716885607091; Tue, 28 May 2024 01:40:07 -0700 (PDT) MIME-Version: 1.0 References: <20240524005444.135417-1-21cnbao@gmail.com> In-Reply-To: From: Barry Song <21cnbao@gmail.com> Date: Tue, 28 May 2024 20:39:55 +1200 Message-ID: Subject: Re: [PATCH] mm: arm64: Fix the out-of-bounds issue in contpte_clear_young_dirty_ptes To: Mark Rutland Cc: Will Deacon , akpm@linux-foundation.org, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Barry Song , Lance Yang , Ryan Roberts , David Hildenbrand , Jeff Xie , Kefeng Wang , Michal Hocko , Minchan Kim , Muchun Song , Peter Xu , Yang Shi , Yin Fengwei , "Zach O'Keefe" , Catalin Marinas Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: A6C9620013 X-Rspam-User: X-Stat-Signature: ddapsxz4w7ir7n88wwndnx43pkx1bqec X-HE-Tag: 1716885609-44966 X-HE-Meta: U2FsdGVkX18gyxTftLIFkt8pdcUuAMkc10yGnwqkt/HsotKE/K51dku01yOB5x9mqpi6P6sFnojoJ6Asc28S+72hno/GXMt/15j686OegJijPy/w8KBwlBdtcbltXIlGJsUERcbPgjcfvKLkBngMF+00iAU7ZQQCLQkhRmSKWPVJH6Qr4L0MK2uCYK31Oo9nnExONpXPZPAlkZw3CUDFimezkNy1K6v2qxH4S+YdF4sG8F5hxTiEWBcPuWs8YKIc6yJQDMtdYOOMABWbFva4FyldXLzGl/jyF2DXzKfviL9r1fE8ap1oGqhoMDGlwMFi2rABnmA+qk1rzTsclS1G8gYTYRHOLMgDSiTeBs46U6XDthkDs7RAz3uXYxrcllmLD52uo6EKLObI6TFeGVLtzeuZTl3LzV9L5Tqr3ZZ3edi/JjOcnwkLZKToZTiBEek6IHTLv19FxvZrVsNZQMX/HkcHNRxoB+XoSei/BaBuLys8EwoItI7tBCb1cMNh+7O6ELPGUxDaw8hEkrzmY0NBJRmsQDDG7J7Oh202NqU1e6Pa95VKxLAZ6XiHJwXm+xzzW4mncrsYH6ECcAAGtPv7X+2RRPI3PwwiJiPPYAguQyfsYtpf4ygW19JY9JI+OEO4DtKixqybh1uN/3B+pD0zSqgVlpOlyz5DkPsWwXG7mMlv6CgtMV4V1mGQ4p2e4HFhUv3hPNOSwQV9nkTG5Bfraoin6d5I+JMhkYl20HfSFNtwNdgzwS8AG+dwNEG9+Crhfd1tEREgNND4/mYzUopkaTw0zjO+2kxl0RNepiWxkkFQfdNsm9DCq3YC6hYei8ewY8jyb14mRjZFFkWSRg+FWVVdOZuW+ARrDHLzNZiV4jU/TMEzRaD60ZgboqBppPamoySnpSGUx28CMPP0HM6A5GNwfwMwyQKzByrr/QbWlsY9faNSxBQkxz5cqqMe82IhYjqJEDxjF6HkmA6wPRO q21WFrHG kC5Qj9JS5x6mNr6n6WLW3IuSZIG8+FfwDvcp+Ia+aAhbW3BrRRsPiVXsLOsrbgbCNbc4jUG3LIe2rc+6+baQN8a7myj58wUwetHEPoh9zjYKWPZiaHvTJL/d3BRkVr14L/K4aY5FZnyXzBg2A6hRc7mh/rNyBfqfVg8Xc/U23m4gm12LgDnyc9pLBC5qJcZA9/O+BWzysx2hl37IKRRtuLo8RrReJ7jJp1SQ/TI+JuIs5VcCO0vLfxSs7Y/GbmDVwibBr2sSZFSZzdwBDyJJ1/FYfj0oSwoG4wYlJwJVkqNv457lae8ddnpyeOKuc/s+8PHdGAcM+jPFUr6K6eFU2A+F1GeqnGuiE556k4BZEXI75hxGtIDNulQiYLLTW3QK7In5aW9+XhWt+l2oAXtBVE3jl4zdEWDDvy5zRwWTvig/m0SICHkzk8dpmfY0wZDQDK9Df1ycD1M49RikwsbY5BXf5MunqOvniScJRgSkx34SMhwMRByyhapE20CHKfwQ8lJDnh96MrwPm0ZP/5D2MV3Ph4x+BCRioIcPyZMYC0NvSiESDR3FYaSWgPAHJp+Q2xwPU2Va6sTe4CzoxGBirYVbPIuvfErlX11QbURVJa4g5uGLFmXOkdaPzFHrdLt9BagBUyPl13sAQDIlg9uMtCWf7dc1Xz0rGAnH6+PcXl+y0QUsHE/PNVRa2z6CS5qICFuGcevY1bsgq0Ti1/McYU6Ft6WGcT+U9nN3loxeGgdU3csHxE2XkNOnCdIssn7DsvRhbQHoLBwnBbLZFcRuBIt/5YputhCx6zqQt+fHwJENbXMxrr4SZnhsHva2MrnKOPiPqwu7m9nf96Gw= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, May 28, 2024 at 8:26=E2=80=AFPM Mark Rutland = wrote: > > On Fri, May 24, 2024 at 12:54:44PM +1200, Barry Song wrote: > > From: Barry Song > > > > We are passing a huge nr to __clear_young_dirty_ptes() right > > now. While we should pass the number of pages, we are actually > > passing CONT_PTE_SIZE. This is causing lots of crashes of > > MADV_FREE, panic oops could vary everytime. > > > > Fixes: 89e86854fb0a ("mm/arm64: override clear_young_dirty_ptes() batch= helper") > > I was seeing ths same thing on v6.10-rc1 (syzkaller splat and reproducer > included at the end of the mail). The patch makes sense to me, and fixed = the > splat in testing, so: > > Reviewed-by: Mark Rutland > Tested-by: Mark Rutland Thanks! > > Since this only affects arm64 and is already in mainline, I assume the fi= x > should go via the arm64 tree even though the broken commit went via mm. Either mm or arm64 is fine with me, but I noticed that Andrew has already included it in mm-hotfixes-unstable. If it works, we may want to stick with that. :-) > > Mark. > > > Cc: Lance Yang > > Cc: Barry Song <21cnbao@gmail.com> > > Cc: Ryan Roberts > > Cc: David Hildenbrand > > Cc: Jeff Xie > > Cc: Kefeng Wang > > Cc: Michal Hocko > > Cc: Minchan Kim > > Cc: Muchun Song > > Cc: Peter Xu > > Cc: Yang Shi > > Cc: Yin Fengwei > > Cc: Zach O'Keefe > > Cc: Catalin Marinas > > Cc: Will Deacon > > Signed-off-by: Barry Song > > --- > > arch/arm64/mm/contpte.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c > > index 9f9486de0004..a3edced29ac1 100644 > > --- a/arch/arm64/mm/contpte.c > > +++ b/arch/arm64/mm/contpte.c > > @@ -376,7 +376,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_= struct *vma, > > * clearing access/dirty for the whole block. > > */ > > unsigned long start =3D addr; > > - unsigned long end =3D start + nr; > > + unsigned long end =3D start + nr * PAGE_SIZE; > > > > if (pte_cont(__ptep_get(ptep + nr - 1))) > > end =3D ALIGN(end, CONT_PTE_SIZE); > > @@ -386,7 +386,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_= struct *vma, > > ptep =3D contpte_align_down(ptep); > > } > > > > - __clear_young_dirty_ptes(vma, start, ptep, end - start, flags); > > + __clear_young_dirty_ptes(vma, start, ptep, (end - start) / PAGE_S= IZE, flags); > > } > > EXPORT_SYMBOL_GPL(contpte_clear_young_dirty_ptes); > > > > -- > > 2.34.1 > > ---->8---- > Syzkaller hit 'KASAN: use-after-free Read in contpte_clear_young_dirty_pt= es' bug. > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > BUG: KASAN: use-after-free in __ptep_get arch/arm64/include/asm/pgtable.h= :315 [inline] > BUG: KASAN: use-after-free in __clear_young_dirty_ptes arch/arm64/include= /asm/pgtable.h:1309 [inline] > BUG: KASAN: use-after-free in contpte_clear_young_dirty_ptes+0x264/0x288 = arch/arm64/mm/contpte.c:389 > Read of size 8 at addr ffff000018c0d000 by task syz-executor392/193 > > CPU: 0 PID: 193 Comm: syz-executor392 Not tainted 6.10.0-rc1-00001-g30b7f= 99b25b6 #1 > Hardware name: linux,dummy-virt (DT) > Call trace: > dump_backtrace+0x12c/0x1f8 arch/arm64/kernel/stacktrace.c:317 > show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:324 > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x184/0x360 lib/dump_stack.c:114 > print_address_description mm/kasan/report.c:377 [inline] > print_report+0xf4/0x5b0 mm/kasan/report.c:488 > kasan_report+0xc0/0x100 mm/kasan/report.c:601 > __asan_report_load8_noabort+0x20/0x30 mm/kasan/report_generic.c:381 > __ptep_get arch/arm64/include/asm/pgtable.h:315 [inline] > __clear_young_dirty_ptes arch/arm64/include/asm/pgtable.h:1309 [inline] > contpte_clear_young_dirty_ptes+0x264/0x288 arch/arm64/mm/contpte.c:389 > clear_young_dirty_ptes arch/arm64/include/asm/pgtable.h:1715 [inline] > madvise_free_pte_range+0xa5c/0x16d8 mm/madvise.c:767 > walk_pmd_range mm/pagewalk.c:143 [inline] > walk_pud_range mm/pagewalk.c:221 [inline] > walk_p4d_range mm/pagewalk.c:256 [inline] > walk_pgd_range+0xca4/0x1900 mm/pagewalk.c:293 > __walk_page_range+0x4bc/0x5b8 mm/pagewalk.c:395 > walk_page_range+0x4a4/0x840 mm/pagewalk.c:521 > madvise_free_single_vma+0x3a0/0x798 mm/madvise.c:815 > madvise_dontneed_free mm/madvise.c:929 [inline] > madvise_vma_behavior mm/madvise.c:1046 [inline] > madvise_walk_vmas mm/madvise.c:1268 [inline] > do_madvise+0x54c/0x2990 mm/madvise.c:1464 > __do_sys_madvise mm/madvise.c:1481 [inline] > __se_sys_madvise mm/madvise.c:1479 [inline] > __arm64_sys_madvise+0x94/0xf8 mm/madvise.c:1479 > __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] > invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:48 > el0_svc_common.constprop.0+0xec/0x2a8 arch/arm64/kernel/syscall.c:133 > do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:152 > el0_svc+0x54/0x160 arch/arm64/kernel/entry-common.c:712 > el0t_64_sync_handler+0x120/0x130 arch/arm64/kernel/entry-common.c:730 > el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:598 > > The buggy address belongs to the physical page: > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58c0= d > flags: 0x3fffe0000000000(node=3D0|zone=3D0|lastcpupid=3D0x1ffff) > raw: 03fffe0000000000 fffffdffc0630388 fffffdffc071cc48 0000000000000000 > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff000018c0cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff000018c0cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >ffff000018c0d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ^ > ffff000018c0d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ffff000018c0d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > Syzkaller reproducer: > # {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: = SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false = Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false = NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysct= l:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptio= ns:{Collide:false Fault:false FaultCall:0 FaultNth:0}} > madvise(&(0x7f0000ffd000/0x3000)=3Dnil, 0x3000, 0x17) > mprotect(&(0x7f0000ffc000/0x4000)=3Dnil, 0x4000, 0x0) > mprotect(&(0x7f0000800000/0x800000)=3Dnil, 0x800000, 0x1) > madvise(&(0x7f0000400000/0xc00000)=3Dnil, 0xc00000, 0x8) > > > C reproducer: > // autogenerated by syzkaller (https://github.com/google/syzkaller) > > #define _GNU_SOURCE > > #include > #include > #include > #include > #include > #include > #include > #include > > #ifndef __NR_madvise > #define __NR_madvise 233 > #endif > #ifndef __NR_mmap > #define __NR_mmap 222 > #endif > #ifndef __NR_mprotect > #define __NR_mprotect 226 > #endif > > int main(void) > { > syscall(__NR_mmap, /*addr=3D*/0x1ffff000ul, /*len=3D*/0x1= 000ul, /*prot=3D*/0ul, /*flags=3DMAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32u= l, /*fd=3D*/-1, /*offset=3D*/0ul); > syscall(__NR_mmap, /*addr=3D*/0x20000000ul, /*len=3D*/0x1000000ul= , /*prot=3DPROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=3DMAP_FIXED|MAP_ANO= NYMOUS|MAP_PRIVATE*/0x32ul, /*fd=3D*/-1, /*offset=3D*/0ul); > syscall(__NR_mmap, /*addr=3D*/0x21000000ul, /*len=3D*/0x1000ul, /= *prot=3D*/0ul, /*flags=3DMAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd= =3D*/-1, /*offset=3D*/0ul); > if (write(1, "executing program\n", sizeo= f("executing program\n") - 1)) {} > syscall(__NR_madvise, /*addr=3D*/0x20ffd000ul, /*len=3D*/0x3000ul= , /*advice=3DMADV_POPULATE_WRITE*/0x17ul); > syscall(__NR_mprotect, /*addr=3D*/0x20ffc000ul, /*len=3D*/0x4000u= l, /*prot=3D*/0ul); > syscall(__NR_mprotect, /*addr=3D*/0x20800000ul, /*len=3D*/0x80000= 0ul, /*prot=3DPROT_READ*/1ul); > syscall(__NR_madvise, /*addr=3D*/0x20400000ul, /*len=3D*/0xc00000= ul, /*advice=3D*/8ul); > return 0; > } > > Thanks Barry